Generate default key file with west ncs-provision, enable automatic KMU provisioning #22516
Conversation
github-actions
bot
added
manifest
changelog-entry-required
|
The following west manifest projects have changed revision in this Pull Request:
✅ All manifest checks OK Note: This message is automatically posted and updated by the Manifest GitHub Action. |
CI InformationTo view the history of this post, clich the 'edited' button above Inputs:Sources:sdk-nrf: PR head: 590b59e906d382279c2c5e5fbdd786d63771481a more detailssdk-nrf:
Github labels
List of changed files detected by CI (7)Outputs:ToolchainVersion: 3ae5dc3c63 Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped;
|
|
You can find the documentation preview for this PR here. |
gchwier
force-pushed
the
grch-west-flash-with-provision
branch
from
2495a58 to
243a05f
Compare
gchwier
force-pushed
the
grch-west-flash-with-provision
branch
3 times, most recently
from
31104aa to
bc69b54
Compare
gchwier
force-pushed
the
grch-west-flash-with-provision
branch
4 times, most recently
from
091f13e to
c7de955
Compare
Memory footprint analysis revealed the following potential issuesapplications.hpf.gpio.icbmsg[nrf54l15dk/nrf54l15/cpuflpr]: High RAM usage: 12430[B] - link (cc: @nrfconnect/ncs-ll-ursus) Note: This message is automatically posted and updated by the CI (latest/sdk-nrf/PR-22516/19) |
gchwier
force-pushed
the
grch-west-flash-with-provision
branch
from
c7de955 to
fcef34a
Compare
sysbuild/Kconfig.mcuboot
Outdated
There was a problem hiding this comment.
squash into previous commit
sysbuild/Kconfig.secureboot
Outdated
There was a problem hiding this comment.
| if(DEFINED SB_CONFIG_SECURE_BOOT_SIGNING_KEY_FILE AND NOT "${SB_CONFIG_SECURE_BOOT_SIGNING_KEY_FILE}" STREQUAL "") | |
| if(SB_CONFIG_SECURE_BOOT_SIGNING_KEY_FILE) |
There was a problem hiding this comment.
use variables directly rather than creating these
gchwier
force-pushed
the
grch-west-flash-with-provision
branch
2 times, most recently
from
6773da0 to
7356910
Compare
This commit introduces the capability to automatically generate the keyfile.json during the build process for nRF54L series devices. Added new Kconfigs in Kconfig.mcuboot and Kconfig.secureboot to control creating keyfile.json during the build process. Creating keyfile.json is implemented in generate_default_keyfile.cmake Signed-off-by: Grzegorz Chwierut <[email protected]>
Enabled nrf54l15dk in bootloader/boot_chains. Automatic KMU provisioning is selected. Updated tests of KMU provisioning with simple tests, where pytest is not required - console harnessis used. Signed-off-by: Grzegorz Chwierut <[email protected]>
gchwier
force-pushed
the
grch-west-flash-with-provision
branch
from
7356910 to
590b59e
Compare
gchwier
changed the title
|
Rebased and removed sdk-zephyr manifest (merged with other PR) |
| set(keyfile) | ||
|
|
||
| if(NOT EXISTS ${signature_private_key_file}) | ||
| message(FATAL_ERROR "Config points to non-existing PEM file '${signature_private_key_file}'") |
There was a problem hiding this comment.
don't like that this throws an error, which means users can't recover from it, but actually seems this is already done in debug_keys.cmake, which oddly means that this will never actually run anyway because the same failure will occur there first, so will allow it
5 participants
Updated manifest to sdk-zephyr.
Changes in zephyr allows to provision KMU keys with
west flashcommand, if keyfile.json (generated by west ncs-provision) is in build directory.Changes in sdk-nrf:
Introduced the capability to automatically generate
the keyfile.json during the build process for nRF54L series devices.
Added new Kconfigs:
to control creating keyfile.json during the build process.
Creating keyfile.json is implemented in generate_default_keyfile.cmake.
Additionally updated tests on nrf54l15dk:
To test is manually on nrf54l15dk:
hello world + NSIB
MCUboot (with KMU enabled)
hello world + NSIB + MCUboot
To run Twister tests: